CVE-2021-46974

What it actually does

The BPF verifier performed incorrect negation of pointer arithmetic when the offset register resided in the destination register, causing the final bitwise masking operation to produce an invalid pointer instead of correctly inverting add/sub operations.

Why it matters to the business

Unpatched kernels may allow local attackers to corrupt kernel memory, potentially leading to crashes, privilege escalation, or container escape in environments that rely on eBPF programs for networking, security, or observability.

How an attack unfolds

An attacker crafts a BPF program that places a negative offset value in the destination register of a pointer arithmetic operation; the flawed negation logic then produces an out-of-bounds pointer that bypasses verifier checks and allows subsequent memory writes or reads.

How to fix it

Upgrade to a Linux kernel containing the referenced fix for the masking negation logic; rebuild and redeploy any custom eBPF programs against the patched kernel headers.

How to confirm the fix worked

Confirm the running kernel version contains the upstream commit that moves the final bitwise AND into AX before the pointer move and arithmetic; re-run verifier test suites that exercise negative-offset pointer arithmetic.

Typical attack path

1. Load a malicious eBPF program containing pointer arithmetic with a negative offset in the destination register
2. Trigger program attachment to a hook that the verifier accepts due to the logic error
3. Execute the program to cause the incorrect pointer calculation and memory corruption
4. Leverage the resulting primitive for further exploitation such as ROP or data-only attacks

How to detect it

Review audit logs for unexpected BPF program loads and check dmesg or verifier logs for any pointer arithmetic warnings around the time of the patch date; no public exploitation artifacts are known.

What your security team should do

• Prioritize kernel upgrades on systems that load untrusted or third-party eBPF programs
• Enable kernel lockdown or unprivileged BPF restrictions where eBPF is not required
• Monitor for unusual eBPF program loads via audit logs